Safest snapshot of a failing harddrive?

First, Copy Most Critical Data Fast

If you have another hard drive in your system, quickly copy your most critical files to that drive. At least you will have a duplicate of your critical data. If you get corrupted data, that is still better than waiting while the situation could be further deteriorating.

Second, Do a Full Image Backup

Then, I would get as much of the bulk of information off the drive as soon as possible. I would try a disk imaging program (like Acronis True Image). That is the quickest way I know to get as much information off of the hard drive as quickly as possible. If there is corruption, you will get that, too... but at least you will have something to work with.

Third, Find and Recover Corrupted Data

If the backup is good, you can restore the image to a new hard drive. If you find corruption, then I would try a program like SpinRite. That program is designed to work tirelessly on your hard drive at the lowest level (even below the operating system level) and really dig into your hard drive data and retrieve every last little bit of data that is ever going to be retrieved.


I've got limited experience with this scenario, but my typical approach is to get as much off the drive ASAP; usually I drop it in a linux box and run a full dd image of the drive.

Once I've got the image I baby the actual drive; put it in an antistatic bag and keep it offline until I can determine if the image was complete/corrupted/etc... if there's anything that's wrong with the image I can decide if I need to bring the drive back online to go after specific data or whether to try another image with a different approach.


ddrescue can be used to first read whatever parts of the disk can be read with no errors, then retry just the problematic sectors. That way if your disk fails completely, you have a good chance of having copied off the unproblematic sectors.